topic Re: Can't find my last 6 month data in Reporting

Can't find my last 6 month data

gijoesplunk — Thu, 05 Oct 2017 04:41:27 GMT

HI everyone,
I usually run report month by month from Januari untill now (and i still have the report), and now i want to get my March dan May data to review it but the no data at all. I tried run search from Januari too and no data, but i can get my June data.
Is there any limitation from splunk to get past data?
FYI, i don't run any archieving.

Re: Can't find my last 6 month data

gjanders — Thu, 05 Oct 2017 12:05:00 GMT

Start in the monitoring console, in particular the indexes view , this should advise if your indexes are full and if the data has therefore been deleted due to the size limits been reached in the indexes.conf file.

Splunk has no limitations in getting data from a few months or years ago...

Re: Can't find my last 6 month data

gijoesplunk — Fri, 06 Oct 2017 02:00:53 GMT

where i can get/see in indexes view? If splunk has no limitations in getting data from a few months/years ago,how can i get my previous data back?

Re: Can't find my last 6 month data

gjanders — Fri, 06 Oct 2017 02:11:04 GMT

If you refer to my link I have linked to the monitoring console documentation and a mention of the indexes page. Also refer to the overview .

Re: Can't find my last 6 month data

gijoesplunk — Fri, 06 Oct 2017 07:14:19 GMT

Ok, i have found monitoring console.Now what can i do to obtain my previous 6 months data?

Re: Can't find my last 6 month data

gjanders — Fri, 06 Oct 2017 13:22:15 GMT

Well what does the monitoring console page say ? If it confirms that it has 6 month old data in the index then it is still there.

If it has been removed / the index is out of space then the data has likely been frozen/deleted and you would need to restore from backup and go through a restoration of data...

Re: Can't find my last 6 month data

gijoesplunk — Tue, 17 Oct 2017 08:51:09 GMT

In Index Details:Instance, The Data Age vs Frozen Age (days) is: 2184, so i will have my data about past 5.9 years isn't it?

Re: Can't find my last 6 month data

gijoesplunk — Tue, 17 Oct 2017 09:00:08 GMT

Addition Information: Earliest event : 2015-01-19 14:10:16+0700 ; so i think if i search the event from 1 April 2017 to 30 April 2017 i should have the data right?

Re: Can't find my last 6 month data

gjanders — Tue, 17 Oct 2017 11:16:18 GMT

Assuming your latest event exists in that time range, yes.

The data will exist for 5.9 years if you do not reach the index size limits, reaching the index size limits will also result in the data freezing...